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CLAIM AMENDMENTS 

1. (Previously Presented) A method of monitoring a network switch having a plurality of 
regular ports between which network traffic data packets are forwarded and an external mirror port, 
comprising: 

selecting at least one of said regular ports; 

mirroring a data packet of said selected port to said external mirror port; 
extracting the network address information of said mirrored data packet; 
determining port information of said network address information in response to said 
network address information extraction; and 

performing network analysis of said network switch. 

2. (Previously Presented) The method of claim 1, wherein said port information comprises 
physical information. 

3. (Previously Presented) The method of claim 1, wherein said port information 
determination comprises interrogating said network switch to obtain said port information using said 
network address information. 

4. (Previously Presented) The method of claim 3, wherein said interrogation comprises: 
sending a first request to said network switch requesting a port index corresponding to said 

network address information; and 

sending a second request to said network switch requesting said port information 
corresponding to said port index. 
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5. (Previously Presented) The method of claim 1, wherein said network address information 
extraction and said port information determination are performed in an external monitor device. 

6. (Cancelled). 

7. (Previously Presented) The method of claim 4, wherein said port information 
determination comprises placing said mirrored data packet in a first-in-first-out buffer waiting for 
responses from said network switch. 

8. (Previously Presented) The method of claim 7, wherein said port information 
determination further comprises releasing said mirrored data packet from said first-in-first-out buffer 
after said network switch responds to said requests. 

9. (Previously Presented) The method of claim 7, wherein said port information 
determination further comprises releasing said mirrored data packet from said first-in-first-out buffer 
after a predetermined period of time. 

10. (Previously Presented) The method of claim 1, further comprising maintaining at least 
one lookup table correlating said network address information with said port information. 

11. (Previously Presented) The method of claim 1, wherein said network address information 
comprises a source address of said mirrored data packet. 

12. (Previously Presented) The method of claim 1, wherein said network address information 
comprises a destination address of said mirrored data packet. 

13. (Previously Presented) The method of claim 1, wherein said network switch is a routing 

switch. 
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14. (Previously Presented) A method to monitor a network switch, comprising: 
externally obtaining at least a portion of data packets received at said network switch, 

wherein each of said data packets comprises network address information; 

extracting said network address information from said obtained portion of data packets; 

determining port information of said network address information in response to said 
network address information extraction; and 

performing network analysis of said network switch using said port information. 

15. (Previously Presented) The method of claim 14, wherein said port information comprises 
physical information. 

16. (Previously Presented) The method of claim 14, wherein said network switch comprises a 
plurality of regular ports and a mirror port, said mirror port being able to mirror network traffic for at 
least one of said regular ports, wherein said portion of data packets are obtained from said mirror 
port. 

17. (Previously Presented) The method of claim 14, wherein said network address 
information comprises source addresses. 

18. (Previously Presented) The method of claim 14, wherein said network address 
information comprises destination addresses. 

19. (Previously Presented) The method of claim 14, wherein said network switch comprises a 
plurality of regular ports, wherein said portion of data packets are obtained by passively tapping at 
least one of said regular ports. 
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20. (Previously Presented) The method of claim 14, wherein said port information 
determination comprises interrogating said network switch to obtain said port information using said 
network address information. 

21. (Previously Presented) The method of claim 20, wherein said interrogation comprises: 
sending a first request to said network switch requesting a port index corresponding to said 

network address information; and 

sending a second request to said network switch requesting said port information 
corresponding to said port index. 

22. (Previously Presented) The method of claim 14, wherein said network address 
information extraction and said port information determination are performed in an external monitor 
device. 

23. (Previously Presented) The method of claim 21, wherein said port information 
determination comprises placing said obtained portion of data packets in a first-in-first-out buffer 
waiting for responses firom said network switch. 

24. (Previously Presented) The method of claim 23, wherein said port information 
determination further comprises releasing a data packet fi-om said first-in- first-out buffer after said 
network switch responds to said first and second requests. 

25. (Previously Presented) The method of claim 23, wherein said port information 
determination further comprises releasing a data packet firom said first-in- first-out buffer after a 
predetermined period of time. 
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26. (Previously Presented) The method of claim 14, further comprising maintaining at least 
one lookup table correlating said network address information with said port information. 

27. (Cancelled) 

28. (Previously Presented) A method to monitor a network switch, comprising: 
extemally obtaining at least a portion of data packets received at said network switch, 

wherein each of said data packets comprises network address information; 

extracting said network address information from said obtained portion of data packets; and 
determining port information of said network address information in response to said 

network address information extraction. 

29. (Previously Presented) The method of claim 28, further comprising performing network 
analysis of said network switch using said port information. 

30. (Previously Presented) The method of claim 28, wherein said port information comprises 
physical information. 

31. (Previously Presented) The method of claim 28, wherein said network address 
information extraction and said port information determination is performed in an extemal 
monitoring device. 

32. (Previously Presented) The method of claim 28, wherein said network switch comprises a 
plurality of regular ports and a mirror port, said mirror port being able to mirror network traffic for at 
least one of said regular ports, wherein said portion of data packets are obtained from said mirror 
port. 
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33. (Previously Presented) The method of claim 28, wherein said network address 
information comprises source addresses. 

34. (Previously Presented) The method of claim 28, wherein said network address 
information comprises destination addresses. 

35. (Previously Presented) The method of claim 28, wherein said network switch comprises a 
plurality of regular ports, wherein said portion of data packets are obtained by passively tapping at 
least one of said regular ports. 

36. (Currently Amended) The method of claim 28, wherein said port information 
determination comprises interrogating said network switch to obtain said portion of port information 
using said network address information. 

37. (Previously Presented) The method of claim 36, wherein said interrogation comprises: 
sending a first request to said network switch requesting a port index corresponding to said 

network address information; and 

sending a second request to said network switch requesting said port information 
corresponding to said port index. 

38. (Previously Presented) The method of claim 37, wherein said first request and said 
second request are SNMP requests. 

39. (Previously Presented) The method of claim 37, wherein said port information 
determination comprises placing said obtained portion of data packets in a first-in-first-out buffer 
waiting for responses from said network switch. 
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40. (Previously Presented) The method of claim 39, wherein said port information 
determination further comprises releasing a data packet from said first-in-first-out buffer after said 
network switch responds to said first and second requests. 

41 . (Previously Presented) The method of claim 39, wherein said port information 
determination further comprises releasing a data packet from said first-in-first-out buffer after a 
predetermined period of time. 

42. (Previously Presented) The method of claim 28, further comprising maintaining at least 
one lookup table correlating said network address information with said port information. 

43. (Previously Presented) The method of claim 28, wherein said network switch is a routing 

switch. 

44. (Previously Presented) The method of claim 28, further comprising associating said port 
information with information contained in said obtained portion of data packets. 

45. (Previously Presented) The method of claim 44, further comprising performing network 
analysis of said network switch using said port information and associated data packet information. 
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